CVE-2021-31581
Last modified
CVE-2021-31581 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. EPSS estimates a 1.22% chance of exploitation in the next 30 days.
Description
The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Akkadianlabs | Ova Appliance | < 3.0 |
| Akkadianlabs | Provisioning Manager | >= 3.0.0, < 3.3.0.314-4a349e0 |
| Akkadianlabs | Provisioning Manager | >= 4.0.0, < 5.0.2 |
References
- https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/Exploit, Third Party Advisory
- https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-31581?
How severe is CVE-2021-31581?
How do I fix CVE-2021-31581?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-31575In Config Manager, there is a possible command injection due…9.8
- CVE-2021-31576In Boa, there is a possible information disclosure due to a …7.5
- CVE-2021-31577In Boa, there is a possible escalation of privilege due to a…9.8
- CVE-2021-31578In Boa, there is a possible escalation of privilege due to a…9.8
- CVE-2021-31579Akkadian Provisioning Manager Engine (PME) ships with a hard…9.8
- CVE-2021-31580The restricted shell provided by Akkadian Provisioning Manag…9.8
- CVE-2021-31583Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including …5.4
- CVE-2021-31584Sipwise C5 NGCP www_csc version 3.6.4 up to and including pl…8.8
- CVE-2021-31585Accellion Kiteworks before 7.3.1 allows a user with Admin pr…6.7
- CVE-2021-31586Accellion Kiteworks before 7.4.0 allows an authenticated use…8.8
- CVE-2021-31589A cross-site scripting (XSS) vulnerability has been reported…6.1
- CVE-2021-3159A stored cross site scripting (XSS) vulnerability in the /sy…5.4
Are you affected by CVE-2021-31581?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST